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REMARKS 

This Application has been carefully reviewed in light of the Office Action 
electronically dated January 30, 2008. Applicants previously canceled Claims 2-3, 6-7, and 
18-19 without prejudice or disclaimer. Applicants respectfully request reconsideration and 
favorable action in this case. 

Section 103 Rejections 

Claims 1, 4, 10-16, 21 and 22 are rejected under 35 U.S.C. § 103(a) as being 
unpatentable over U.S. Patent No, 6,192,512 issued to Chess {''Chess'') in view of U.S. Patent 
No. 5,389,196 issued to Chambers {''Chambers''), Applicants respectfully traverse this 
rejection. Claim 1 recites: 

A method of detecting viral code in subject files, comprising; 

creating an artificial memory region spanning one or more components 
of the operating system; 

emulating execution of at least a portion of computer executable code 
in a subject file; 

monitoring operating system calls by the emulated computer 
executable code to detect an attempt by the emulated computer executable 
code to read the artificial memory region; and 

determining based on the attempt to access the artificial memory 
region that the emulated computer executable code is viral. 

The proposed Chess-Chambers combination, however, fails to disclose, teach, or 
suggest every element of Claim 1. For example, the proposed Chess-Chambers combination 
fails to disclose "monitoring operating system calls by the emulated computer executable 
code to detect an attempt by the emulated computer executable code to read the artificial 
memory region." As the Examiner concedes. Chess fails to disclose this limitation. Office 
Action, p. 3. 

Additionally, combining Chess with Chambers fails to remedy this omission. The 
cited portion of Chambers merely indicates that the monitor program described by Chambers 
"can be executed automatically whenever an operating system call is placed to execute a 
program." Chambers, col. 6, 11. 66-68, emphasis. The cited portion does not disclose 
"monitoring operating system calls by the emulated computer executable code to detect an 
attempt by the emulated computer executable code to read the artificial memory region " 
(emphasis added). In response to this argument, the Examiner states simply that "[s]ince the 
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operating system provides access to memory via system calls. Chambers teaches monitoring 
operating system calls by emulated computer executable code." Office Action, p. 6. 
Applicants respectfully note, however, that the cited portion of Chambers does not indicate 
that the "operating system provides access to memory via system calls" for all memory 
accesses as the Examiner contends. Thus, Chambers also fails to disclose this element of 
Claim 1. 

As a result, the proposed Chess-Chambers combination fails to disclose, teach, or 
suggest every element of Claim 1. Claim 1 is thus allowable for at least these reasons. 
Applicants respectfully request reconsideration and allowance of Claim 1 and its dependents. 

Although of differing scope from Claim 1, independent Claims 10-12 and 14 include 
elements that, for reasons substantially similar to those discussed with respect to Claim 1 , are 
not disclosed by the proposed Chess-Chambers combination. Claims 10-12 and 14 are thus 
allowable for at least these reasons. Applicants respectfully request reconsideration and 
allowance of Claims 10-12 and 14, and their respective dependents. 

Claims 8, 9, 20 and 23 are rejected under 35 U.S.C. § 103(a) as being unpatentable 
over Chess and Chambers in view of U.S. Patent No. 5,974,549 issued to Golan (^'Golarf^), 
Claims 8, 9, and 23 depend from Claim 1, while Claim 20 depends from Claim 14. Claims 1 
and 14 have been shown above to be allowable. Claims 8, 9, 20, and 23 are thus allowable 
for at least these reasons. Applicants respectfully request reconsideration and allowance of 
Claims 8, 9, 20, and 23. 

In addition, several of the dependents of Claims 1, 10-12, and 14 include additional 
elements that are not disclosed by the cited references. As one example. Claim 23 recites: 
The method of claim 1, further comprising: 

monitoring access by the emulated computer executable code to 
dynamically linked functions; and 

determining based on attempted access to dynamically linked functions 
that the emulated computer executable code is viral. 

Chess, Chambers, and Golan, both alone and in combination, fail to disclose every 
element of Claim 23. For example, the proposed Chess-Chambers-Golan combination fails 
to disclose "determining based on attempted access to dynamically linked functions that the 
emulated computer executable code is viral." The portion of Golan referenced by the 
Examiner in addressing this element indicates only that the described security monitor can be 
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implemented in a system that includes "one or more system DLLs 90." Golan, col. 13., 11. 9- 
10. The described portion of Golan, however, only discloses monitoring of API calls . 
Golan, col. 13, 11. 43-45. The cited portion does not indicate that the system of Golan 
"determin[es] based on attempted access to dynamically linked functions that the emulated 
computer executable code is viral." Thus, the proposed Chess-Chambers-Golan combination 
fails to disclose "determining based on attempted access to dynamically linked functions that 
the emulated computer executable code is viral" as required by Claim 23. 

As a result, the proposed Chess-Chambers-Golan combination fails to disclose 
additional elements of Claim 23. Claim 23 is thus allov^able for at least this additional 
reason. Applicants respectfully request reconsideration and allowance of Claim 23. 
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Conclusions 



Applicants have made an earnest attempt to place this case in condition for allowance. 
For the foregoing reasons, and for other reasons clearly apparent, Applicants respectfully 
request full allowance of all pending Claims. If the Examiner feels that a telephone 
conference or an interview would advance prosecution of this Application in any manner, the 
undersigned attorney for Applicants stands ready to conduct such a conference at the 
convenience of the Examiner. 

No fees are believed to be due, however, the Commissioner is hereby authorized to 
charge any required fees or to credit any overpayments to Deposit Account No. 02-0384 of 
Baker Botts L.L.P. 



Respectfully submitted, 



BAKER BOTTS L.L.P. 



Attorneys for Applicants 
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